"double free or corruption (out)" in zsh correct

"double free or corruption (out)" in zsh correct

[Henning Reich]

Hi,

you probably already know but it seems there is a bug in the correct
function (or is this not part of zsh?).
To reproduce see the steps below. Tested on arch and ubuntu 20.04.

Thanks a lot
Henning

--

henning@homeoffice ~ % zsh --version
zsh 5.8 (x86_64-pc-linux-gnu)
henning@homeoffice ~ % A=$(PWD)
zsh: correct 'PWD' to 'pwd' [nyae]? y
double free or corruption (out)


Achtung: Das Programm „/bin/zsh“ ist abgestürzt.

Re: "double free or corruption (out)" in zsh correct

[Bart Schaefer]

On Wed, Jul 21, 2021 at 6:03 AM Henning Reich <henning.reich@gmail.com> wrote:
>
> you probably already know but it seems there is a bug in the correct
> function (or is this not part of zsh?).

I can reproduce:

ubuntu% setopt correct
ubuntu% A=$(PWD)
zsh: correct 'PWD' to 'pwd' [nyae]? y
 hist.c:1710: BUG: hwget() called in middle of word
zsh: segmentation fault (core dumped)  Src/zsh -f

Re: "double free or corruption (out)" in zsh correct

[Peter Stephenson]

On Wed, 2021-07-21 at 10:03 -0700, Bart Schaefer wrote:
> On Wed, Jul 21, 2021 at 6:03 AM Henning Reich <henning.reich@gmail.com> wrote:
> > 
> > you probably already know but it seems there is a bug in the correct
> > function (or is this not part of zsh?).
> 
> I can reproduce:
> 
> ubuntu% setopt correct
> ubuntu% A=$(PWD)
> zsh: correct 'PWD' to 'pwd' [nyae]? y
>  hist.c:1710: BUG: hwget() called in middle of word
> zsh: segmentation fault (core dumped)  Src/zsh -f

We don't currently have the tools to do the history replacement within the
recursive analysis of the $(...), which doesn't maintain history with all
the detail of the main command line.  It's probably better just to turn
it off there for now.  This means the word seen is A=$(PWD) so it
doesn't get corrected.  Anything more is more work.

pws

diff --git a/Src/hist.c b/Src/hist.c
index 42cae030c..6ac581fda 100644
--- a/Src/hist.c
+++ b/Src/hist.c
@@ -339,6 +339,13 @@ hist_in_word(int yesno)
 	histactive &= ~HA_INWORD;
 }
 
+/**/
+int
+hist_is_in_word(void)
+{
+    return (histactive & HA_INWORD) ? 1 : 0;
+}
+
 /* add a character to the current history word */
 
 static void
diff --git a/Src/lex.c b/Src/lex.c
index 37fcec3e2..ece02659e 100644
--- a/Src/lex.c
+++ b/Src/lex.c
@@ -1889,6 +1889,7 @@ exalias(void)
     hwend();
     if (interact && isset(SHINSTDIN) && !strin && incasepat <= 0 &&
 	tok == STRING && !nocorrect && !(inbufflags & INP_ALIAS) &&
+	!hist_is_in_word()  &&
 	(isset(CORRECTALL) || (isset(CORRECT) && incmdpos)))
 	spckword(&tokstr, 1, incmdpos, 1);